f4f4f213632637246df8429c1521e0aadccf2de582e67e97db805ed34e73728b

Resubmissions

07/09/2026, 13:08

260907-qddd4sam8t4

07/09/2026, 12:49

260907-p2vgvsal7z4

Analysis

user interaction
yes
max time kernel
64s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
communication_253780_9601.pdf
Size 188KB
Sample260907-p2vgvsal7z
SHA256 f4f4f213632637246df8429c1521e0aadccf2de582e67e97db805ed34e73728b
MD5 433bcf3404b474fd351df3e3c7af9534
SHA1 eef3861a5efca3ca87ab35552e17ece947636c91
SHA512 b2e513241bb5eb6ae82deaaef9ac3926725a88b3ad669a2a237ca378959ac4e748bf2518e2fbf0b5837e48e3c695d5bce16029e52c8548fda6184e447704c42f
SSDEEP 3072:AQfVTdptzTb9ty0EBywiP1YOwCktaFRN/mYi26ejs1V8/fc0t6UyGy1dvd4E:5dZHht/p3PECktaPN/PuwWGgvZ
TLSH
T16B14F137DA69854DE881C9F9C0353B54836DF31BB1C9B4E1693C4E9243D4CA2BA634EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery spyware

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_2964_641790546\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2964_655028879\dasherSettingSchema.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5336	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332590368919728"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{0EC3585A-C65A-4630-9CD8-C66E6B1F3F1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4584	AcroRd32.exe
2964	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe
4584	AcroRd32.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4520	4584	AcroRd32.exe	85
PID 4520 wrote to memory of 3820	4520	RdrCEF.exe	87
PID 4520 wrote to memory of 1032	4520	RdrCEF.exe	88
PID 4520 wrote to memory of 1032	4520	RdrCEF.exe	88
PID 4520 wrote to memory of 1712	4520	RdrCEF.exe	89
PID 4520 wrote to memory of 4064	4520	RdrCEF.exe	90
PID 4520 wrote to memory of 4064	4520	RdrCEF.exe	90
PID 4520 wrote to memory of 4784	4520	RdrCEF.exe	91
PID 4520 wrote to memory of 6072	4520	RdrCEF.exe	92
PID 4584 wrote to memory of 2964	4584	AcroRd32.exe	98
PID 2964 wrote to memory of 1800	2964	msedge.exe	99
PID 2964 wrote to memory of 5560	2964	msedge.exe	101
PID 2964 wrote to memory of 5336	2964	msedge.exe	102
PID 2964 wrote to memory of 5560	2964	msedge.exe	101
PID 2964 wrote to memory of 5560	2964	msedge.exe	101
PID 2964 wrote to memory of 2392	2964	msedge.exe	103
PID 2964 wrote to memory of 2392	2964	msedge.exe	103
PID 2964 wrote to memory of 1216	2964	msedge.exe	104
PID 2964 wrote to memory of 4708	2964	msedge.exe	105
PID 2964 wrote to memory of 1216	2964	msedge.exe	104
PID 2964 wrote to memory of 1216	2964	msedge.exe	104
PID 2964 wrote to memory of 4708	2964	msedge.exe	105
PID 2964 wrote to memory of 4708	2964	msedge.exe	105
PID 2964 wrote to memory of 4860	2964	msedge.exe	107
PID 2964 wrote to memory of 4860	2964	msedge.exe	107
PID 2964 wrote to memory of 4860	2964	msedge.exe	107
PID 2964 wrote to memory of 5748	2964	msedge.exe	108
PID 2964 wrote to memory of 1792	2964	msedge.exe	109
PID 2964 wrote to memory of 5748	2964	msedge.exe	108
PID 2964 wrote to memory of 1792	2964	msedge.exe	109
PID 2964 wrote to memory of 1752	2964	msedge.exe	111
PID 2964 wrote to memory of 5580	2964	msedge.exe	118
PID 2964 wrote to memory of 976	2964	msedge.exe	119
PID 2964 wrote to memory of 5600	2964	msedge.exe	120
PID 2964 wrote to memory of 6064	2964	msedge.exe	122
PID 2964 wrote to memory of 6064	2964	msedge.exe	122
PID 2964 wrote to memory of 2888	2964	msedge.exe	123
PID 2964 wrote to memory of 2888	2964	msedge.exe	123
PID 2964 wrote to memory of 4452	2964	msedge.exe	127
PID 2964 wrote to memory of 4452	2964	msedge.exe	127

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\communication_253780_9601.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D32701500759914BBF0C93640C2DC665 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3820
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=65A045228DBCDF358DF27FE5951570FB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=65A045228DBCDF358DF27FE5951570FB --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1032
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E6440A9AB279A7A5813A0373C4DF5E6 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=68E15F565D1CA359347C95F1E6E55CED --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=68E15F565D1CA359347C95F1E6E55CED --renderer-client-id=5 --mojo-platform-channel-handle=1856 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7F43F6D59A3A203028FE9ABB54331FC --mojo-platform-channel-handle=2684 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FDA969120A09239FE0349CEF1357CCA6 --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.certexpress.com/?r=pR-mC-Lf-8Y-6P-xx-sV-93
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff845ddc188,0x7ff845ddc194,0x7ff845ddc1a0
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,13397861712962430021,14102992410856812066,262144 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:2
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,17742359956251330045,14139208822844327940,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,11914165754176430733,4889982557970109623,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15745077420824508268,7373464701274210293,2097152 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5489894763102718963,4242844762791853407,2097152 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,1366950401442886661,13274348156334922651,2097152 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,4440156653873132668,5172527862800675577,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,15999233308660082690,1891378837397947566,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,15304144727821552983,6593101789807666771,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,15304144727821552983,6593101789807666771,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11623623095939855287,16757047558206947824,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7721147660470611565,3782583413987839980,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
    3⤵
    PID:976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1773585054142672590,4460698457476412675,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,8552757023231265614,9771482799694932568,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9552510654554181918,7872116567419840324,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1090505057583849048,10022072565441634232,524288 --field-trial-handle=2992,i,14709364642237409858,12875457622940290508,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 b724c5733e84c78e32c0574fa45839467312d1b16ea11b8e74f77516a198a8c5
MD5 ab6bf6e5d6d2c9eb64d2ee6e7fb672cb
SHA1 4b88f418f134ff1af6c70525449af8fe812dca3b
SHA512 7fc5ab480d32dd632e8e0338d296674901a01b3cf881283971723921babc3b39c805079e7e726c9846137fd3a347e91d237a00085b9e884e69bf4cf5507f515d
SSDEEP 384:yepdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:w+eUZsLQCZsL3hUS4
TLSH
T10553CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 295c7140fb0324eef4dd45f9e511ba4a5e3f421a866450e2ab5f89cd53d6862c
MD5 6497bf5cbf72f57be1a662a1e16b6c07
SHA1 dedae14e3d669b05726dccbacbe92ef2e92cbfbb
SHA512 36b9c538ca07ca6106a8126042540da314987fefc58601a0ace74453943607556ff07b0b1ec6a463acbe66c5f7cc66be29577350cdaad63c56c767a0236d571c
TLSH
T1F2E02B66C861EC3728FD0B58A44A8A4AE70013572641498F3A3D81498FB563A45C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 65a6c88108e8598943f8d082c4ac05fda5f59b85bf6fc250282d305f28a3c0b0
MD5 72710b07e88428bf143d75300236b5e4
SHA1 c14399dee0411012e5db2a01c31920e807d8c2b7
SHA512 9e1d7743a01b13f325c4147f06530d302f8f52adc79e2ad215f129f3b723079aa27ddb45fd30b84ec4062a64a21e8e07558bbed3ffecf11491607bd85cf5373c
TLSH
T176710939FA02C939EB63433194E03E18B8B081D5FBEB0EF21968D4353CD6B14431C698
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 706b77955e101474fd95d7d777f873410ab43e1367065781a75f293c9db765da
MD5 08fce4b168214d076504d5bbf909e768
SHA1 82ac6aa17347f07fd09220f4f553d37d4ce8944e
SHA512 432a45edf4c215c485902dba501e21fc30cd06e427fddb86b191d38d52139e658a817b7133743a8fb8f871136135479ca38adc5240c1ac6e62469e6228f6ea91
SSDEEP 192:sxZnRzyMqZjK1Ml8Mym/fYsrGpaZdIaRuv9zodpoNHW6+WNwCJ/JE/6BIlLXGuU8:sxZnEam/fYsrGpazIKYWEHbz/nBGvSe
TLSH
T19A72E806A674597B8DDBD61AF645BB57D2F90463A1944E84AAFCCE0C00E7AED3203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 20f218b345e0eaeffa33600fdc0e573f6924a97829763b26560c3ce1bdc569a8
MD5 414919b9ffb169ae04d879baaeb97c29
SHA1 5fd47d8a2dfb665184e83779deaac2043bec6ff1
SHA512 3317ddd586a526e60f91d4ef6b8e0db6d894932bca69427c808e570726a97a2e41afa98f4f24d806536b9d60e6462bd284867c90fff6730806eecde2ff146b71
SSDEEP 192:sxZnRzyMqZjK1Ml8Mjm/fYsskpaZdIaRuv9zodpoNHW6+WNwCJ/JE/6BIlLXGuUI:sxZnE7m/fYsskpazIKYWEHbz/nB1vje
TLSH
T12272F806A674597B8DDBD21AF645BB57D2F90463A1944E84AAFCCE0C00E7AED3203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 82e362bf178a0a7bc2b818f25e7e414bed4292b97cda77d6e26d035e9056a691
MD5 444c911e3b9e1a520cc3bbffe4ccf59b
SHA1 365e7aa0b912bbc14bbf3b3455246df04036d049
SHA512 a4b4d08db048ac1afb5186102150a00f32f4cc6ff54882cea80b4a0fecf256d8e250c002a659e2b4b05192290f74cf8ae885c6cf879a9b6e09c3fcbaa0fba69b
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEysy10Lle:eY8Od/HEnFhWvFvmXu1jawt10Lm2NurB
TLSH
T1FAF2FB3B6C0CCF7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 836785c0e8c03172aea249b36b19c98598fcf4af8c668bf39e928a98045dc607
MD5 b7cfb2e10590e11ae1d1ddae96775e01
SHA1 1c568c54df375d27d092dabb6b30b14984ad6f5f
SHA512 066d6aaa71ee2ebb77fc4f112bea39639274cfd2dbd0cba65905ba9a614c3a3c0190205fb021e756453920478cfa14ff74cd3992c580d128ec63c4113fada930
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG4:05ppxnY753RNBvRJJdt7p5J91dXM
TLSH
T164B27E5A703E0212397E3988B39696364F4135A37058E4AF7FB814A54F27E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bb3c3f85ef374fb4202db26ef6348d6ddee5dba59d888ae54373a7fb8560c6a3
MD5 6129a7494ccf93ab2f94d34bd15a706b
SHA1 200546d3ed853659e2fd8c794f315701c7b603f9
SHA512 11f8a6a7f33f6168ee57ab4b6969f25b6dbd9ab6a22b2100e3a3d5f2bf6ef372788eeaa9869bde7afacfffbba128d28149d591d93bbea5bd9d90eb944d913acd
SSDEEP 384:npDiF9CcmyWCs3sN88TUNTUlIm2QckCr9leKphiftGWE3jyyphe4KV8p0xHDty/8:puFccps35wgbkU4koGWOWeI8p0hvV
TLSH
T177B26C36EC68DABBECE74F99B74A7A07DEE0527785D84AD4CAD85D4C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8afbd851f487ed88d8cf645d604dda7f95169832aaf750af1e0387bcfc50a482
MD5 ad04c153b8be2e0fb8abbc38562712ba
SHA1 284cf99ebb252a49a74d1b38f238e487996187da
SHA512 ae302e13b51854490297bbeda52a15be80bd21819d7f076bfe7a4500cf14f2bc47ef42f1a40c9b5cf6b1b90c9ed173d066c8e328c3a5f64d533b7f1a1db3c185
SSDEEP 384:npaiF9CcmyWCs3sNn8TUNTUlIm2QckCr9Ow4phiftGWE3jYKx0pGe4KV8p0xHDtD:pRFccps36wgbkUnuoGWOHxPI8p0hvV
TLSH
T1BAC26C36ECA8DABBECE74F99B74A7A07DEE0517785D85AD4CAD84D4C009719C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ae1270d44f9c17af4369de6065da9249548ee592b53207d1c34d3d164a60adb6
MD5 6bf8e90214ddcbbeb3a455ff7cb310fd
SHA1 2b4c2b43dd366897aa31b0dc2f1d7b39b2248e29
SHA512 c485558f1da6e729abc10e228ceab907effca71b469b0eba8fe0acc3cbf888fc96860334344f8f17af3db89f0a40b8f861d4a9cf3800bb0fd3d76e84ff6ec52c
SSDEEP 384:npkiFiZcI53sN78TUNTUlI4MQckCruP7phiftGWE3jYQx0pG7O6R2FeoKh7Uptyn:p/FQ53qwgTkRVoGWOjxP7TRNt9
TLSH
T1C0C25C36D8A4DABBEDFB8FC6A74A7607AEF051A385DC4AC4D9D94E5C008719D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4ef80dc9e69fa21c74d7dd35a92066e2d756e78a20147b32b4ed3f8a0c5f079d
MD5 4cf19f3b5ff5e2215e389612b0e243bd
SHA1 005a77b96ab92a994db421db20bcfa92d7d82f7a
SHA512 837abfb41a2aa8d44863d21ae940bf303433a078d9171dc0c86f82ea5f7646285a0f0b1cf0f0795f1a7dd6059a91c0ed17b004bc479cfcca27464327b8329ec8
SSDEEP 384:nyiFEZcI63sN78TUNTUlI4/QckCrtP7phiftGWE3jYQx0pG7O6R2FeoKh7Upty//:5Fi63qwgukQVoGWOjxP7TRNt9
TLSH
T16EC24C36DCA4DAB7EDFB8FC5A74A7607AEF051A385D84AC4D9D94E5C008719D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4dfea0c51e538000ff5b9bfd40112a7639c8c53f0b58af23dfa336d7a1083bb9
MD5 e5338067573efcd35c5f0e0351e9265a
SHA1 c215b3511f8ca5154f09f4f5d93caee77c2f8b7c
SHA512 b7329ad3ce21c2b02a2adabeaea28d918014c75c73fde0444506c8baa1f441d0ea3ab459c432b7037b38de0ebb81cf2cbad8a277ce83da4df591e8aa9c3d1070
SSDEEP 384:npkiFEZcI63sN78TUNTUlI4/QckCrtP7phiftGWE3jYQx0pG7O6R2FeoKh7Uptyn:p/Fi63qwgukQVoGWOjxP7TRNt9
TLSH
T101C24C36E8A4DAB7EDFB8FC9A74A7607AEF051A385D84AC4D9D94E5C008719D0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55ea9c4ae77d6e72e94e0d30886f21aba90a7ba4f5f4d23fcb4cd40ecf64c36a
MD5 3fc9acd6393a8e76294f8e67be394610
SHA1 27992872f95957f8c2536000f68ec5db3cd71c56
SHA512 e31826473f467868943d3cfad5ad36235944bd92b708ea86fc1a8e9651e2ac31eb0e0b2abda141902136f32c05d9d7044d14815a1aa07f483560f15e50872765
TLSH
T1D041275DBAEA1158B3B77E5AAFF6686E487FB9732E06D05D00010E4F0627A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1752-255-0x0000016294BB0000-0x0000016295BB0000-memory.dmp

Download